GoPackage

github.com/argoproj/argo-workflows/v3

17 known vulnerabilities (1 critical, 12 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: v3.7.18 (Aug 14, 2026): affected by 4 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 17 · 1 critical, 12 high, 2 medium, 1 low

Releases: 176 since v3.0.0 (Mar 30, 2021)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-54526
Affects v3.0.0-rc2 to v3.7.14 (v3.7.15 is outside it)
CVE-2026-42296
Affects v3.0.0-rc2 to v3.7.13 (v3.7.14 is outside it)
CVE-2026-42295
Affects v3.0.0-rc2 to v3.7.18 (through the newest release)
CVE-2026-42294
Affects v3.0.0-rc2 to v3.7.13 (v3.7.14 is outside it)
CVE-2026-42183
Affects v3.0.0-rc2 to v3.7.18 (through the newest release)
CVE-2026-42297
Affects v3.0.0-rc2 to v3.7.18 (through the newest release)
CVE-2026-40886
Affects v3.6.5 to v3.7.18 (through the newest release)
CVE-2026-31892
Affects v3.0.0-rc2 to v3.7.10 (v3.7.11 is outside it)
CVE-2026-28229
Affects v3.0.0-rc2 to v3.7.10 (v3.7.11 is outside it)
CVE-2026-23960
Affects v3.0.0-rc2 to v3.6.16 (v3.6.17 is outside it); v3.7.0 to v3.7.7 (v3.7.8 is outside it)
CVE-2025-66626
Affects v3.0.0-rc2 to v3.6.13 (v3.6.14 is outside it); v3.7.0 to v3.7.4 (v3.7.5 is outside it)
CVE-2025-62157
Affects v3.0.0-rc2 to v3.6.11 (v3.6.12 is outside it); v3.7.0 to v3.7.2 (v3.7.3 is outside it)

Show all 17 advisoriesShow fewer advisories

CVE-2025-62156
Affects v3.0.0-rc2 to v3.6.11 (v3.6.12 is outside it); v3.7.0 to v3.7.2 (v3.7.3 is outside it)
CVE-2024-53862
Affects v3.5.7 to v3.5.12 (v3.5.13 is outside it); v3.6.0-rc1 to v3.6.1 (v3.6.2 is outside it)
CVE-2024-47827
Affects v3.6.0-rc1 (v3.6.0-rc2 is outside it)
CVE-2022-29164
Affects v3.0.0-rc2 to v3.2.10 (v3.2.11 is outside it); v3.3.0 to v3.3.4 (v3.3.5 is outside it)
CVE-2021-37914
Affects v3.1.0 to v3.1.5 (v3.1.6 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

CVE-2026-54526High 8.9
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Affected: fixed in 3.7.15.
Fixed in v3.7.15 (released Jun 10, 2026, 36 days before disclosure).
The latest release, v3.7.18, is not affected.
CVE-2026-42296High 8.1
Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing…
Affected: fixed in 3.7.14.
Fixed in v3.7.14 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v3.7.18, is not affected.
CVE-2026-42295High 8.5
Argo Workflows: Exposure of artifact repository credentials
Affected: all versions.
No fix released. The latest release, v3.7.18, is still affected.
CVE-2026-42294High 8.2
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Affected: fixed in 3.7.14.
Fixed in v3.7.14 (released Apr 23, 2026, 16 days before disclosure).
The latest release, v3.7.18, is not affected.
CVE-2026-42183Low 2.3
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
Affected: all versions.
No fix released. The latest release, v3.7.18, is still affected.
CVE-2026-42297High 8.5
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Affected: all versions.
No fix released. The latest release, v3.7.18, is still affected.
CVE-2026-40886High 7.7
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
Affected: from 3.7.0, fixed in 3.7.14; from 3.6.5, through 3.6.19; from 3.6.5.
No fix released. The latest release, v3.7.18, is still affected.
CVE-2026-31892High 8.9
WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
Affected: fixed in 3.7.11.
Fixed in v3.7.11 (released Mar 11, 2026, the day of disclosure).
The latest release, v3.7.18, is not affected.
CVE-2026-28229Critical 9.8
Argo Workflows has unauthorized access to Argo Workflows Template
Affected: fixed in 3.7.11; from 3.7.0, fixed in 3.7.11.
Fixed in v3.7.11 (released Mar 11, 2026, the day of disclosure).
The latest release, v3.7.18, is not affected.
CVE-2026-23960High 7.3
Argo Workflows affected by stored XSS in the artifact directory listing
Affected: fixed in 3.6.17; from 3.7.0, fixed in 3.7.8; fixed in 3.6.17; from 3.7.0, fixed in 3.7.8.
Fixed in v3.6.17 (released Jan 21, 2026, the day of disclosure) and v3.7.8 (released Jan 21, 2026, the day of disclosure).
The latest release, v3.7.18, is not affected.
CVE-2025-66626High 8.1
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Affected: fixed in 3.6.14; from 3.7.0, fixed in 3.7.5; from 3.7.0, fixed in 3.7.5; fixed in 3.6.14.
Fixed in v3.6.14 (released Dec 8, 2025, 1 day before disclosure) and v3.7.5 (released Dec 8, 2025, 1 day before disclosure).
The latest release, v3.7.18, is not affected.
CVE-2025-62157High 8.5
Argo Workflows exposes artifact repository credentials in workflow-controller logs
Affected: from 3.7.0, fixed in 3.7.3; fixed in 3.6.12; fixed in 3.6.12; from 3.7.0, fixed in 3.7.3.
Fixed in v3.6.12 (released Oct 14, 2025, the day of disclosure) and v3.7.3 (released Oct 14, 2025, the day of disclosure).
The latest release, v3.7.18, is not affected.
CVE-2025-62156High 8.1
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
Affected: fixed in 3.6.12; from 3.7.0, fixed in 3.7.3; fixed in 3.6.12; from 3.7.0, fixed in 3.7.3.
Fixed in v3.6.12 (released Oct 14, 2025, the day of disclosure) and v3.7.3 (released Oct 14, 2025, the day of disclosure).
The latest release, v3.7.18, is not affected.
CVE-2024-53862Medium 6.3
Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode
Affected: from 3.5.7, fixed in 3.5.13; from 3.6.0-rc1, fixed in 3.6.2; from 3.5.7, fixed in 3.5.13; from 3.6.0, fixed in 3.6.2.
Fixed in v3.5.13 (released Dec 2, 2024, the day of disclosure) and v3.6.2 (released Dec 2, 2024, the day of disclosure).
The latest release, v3.7.18, is not affected.
CVE-2024-47827Medium 5.7
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Affected: from 3.6.0-rc1, fixed in 3.6.0-rc2; from 3.6.0-rc1, fixed in 3.6.0-rc2.
Fixed in v3.6.0-rc2 (released Oct 2, 2024, 26 days before disclosure).
The latest release, v3.7.18, is not affected.

Show all 17 advisoriesShow fewer advisories

CVE-2022-29164High 7.1
Privilege Escalation in argo-workflows
Affected: from 2.6.0, fixed in 3.2.11; from 3.3.0, fixed in 3.3.5.
Fixed in v3.2.11 (released May 3, 2022, 2 days before disclosure) and v3.3.5 (released May 3, 2022, 2 days before disclosure).
The latest release, v3.7.18, is not affected.
CVE-2021-37914Unrated
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when…
Affected: from 3.1.0, fixed in 3.1.6.
Fixed in v3.1.6 (released Aug 12, 2021, 10 days after disclosure).
The latest release, v3.7.18, is not affected.